- Add require(skill:manage) for hide/unhide/archive/unarchive endpoints
- Add allow (no scope) for social ops: star, rate, report, notifications
- Update DeviceAuthService default scope to include skill:manage
- Update TokenController default scope to include skill:manage
All lifecycle methods (hideSkill, archiveSkill, unarchiveSkill, deleteVersion,
unhideSkill) now accept a Set<String> platformRoles parameter for SUPER_ADMIN/
SKILL_ADMIN bypass. Updated all test calls to pass null for this parameter.
AdminSkillControllerTest now mocks hideSkillAsAdmin instead of hideSkill.
Add platformRoles parameter to skill lifecycle methods:
- hideSkill, archiveSkill, unhideSkill, unarchiveSkill, deleteVersion
- Support SUPER_ADMIN and SKILL_ADMIN role bypass
- Add hideSkillAsAdmin and unhideSkillAsAdmin for admin controllers
- Fix userId null checks in rating and star controllers
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
- Fix SkillStarController to use @RequestAttribute instead of @AuthenticationPrincipal
- Fix SkillRatingController to use @RequestAttribute instead of @AuthenticationPrincipal
- Fix SkillGovernanceService NPE when userNamespaceRoles is null
- Update ApiTokenAuthenticationFilter to properly populate userNsRoles
- Enhance error messages for 403 vs 401 status codes
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
- Add 'me namespaces' subcommand to list accessible namespaces
- Remove standalone 'namespaces' command from CLI
- Rename 'My Skills' help section to 'My Profile'
- Move namespaces listing under My Profile section
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Add unified permission model for skill lifecycle operations:
- Skill owners can hide/unhide/archive their own skills
- Namespace admins/owners can manage skills in their namespace
- Platform admins retain full access via admin endpoints
Changes:
- SkillGovernanceService: add permission checks to hideSkill/unhideSkill
- SkillLifecycleAppService: add hideSkill/unhideSkill methods
- GovernanceWorkflowAppService: add facade methods for hide/unhide
- SkillLifecycleController: add POST /{namespace}/{slug}/hide and /unhide endpoints
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
- Merge list and check into unified list command with status filtering
- Add skill-status.ts core module for shared discovery logic
- Unify interaction flow: scope -> agent -> status -> display
- Replace -g/-p/-a flags with --scope option
- Simplify check as alias for list --status managed,missing
- Fix uninstall to properly handle 'All' scope selection
- Display orphaned skills with [orphaned] marker in uninstall
- Update help text and examples
BREAKING CHANGE: Removed -g/--global, -p/--project, -a/--all flags from list command.
Use --scope global|project|all instead.
- Add interactive namespace selection to inspect command (like install)
- Add version selection when multiple versions exist (--version to skip)
- Skip version selection when --details is specified (shows all versions)
- Add error handling for 403/404 errors with helpful messages
- Add 'for installation' and 'for details' hints to explore command
- Reorganize help: separate 'Discover & Info' and 'Social & Reviews' sections
- Remove --rating option and rating sort (API doesn't support it)
- Add --stars shorthand for star-based sorting
- Fix interactive-search.ts to use stars sort instead of rating
- Add ratingAvg field to SkillDetail and display in explore output
- Delete deprecated versions.ts command (functionality merged into inspect)
- Replace dim() function calls with chalk.dim() to return strings
- Use array join approach for clean output formatting
- Fix undefined output in environment variable instructions
- Simplify config command: remove <key> parameter, hardcode registry
- config set <value> now directly sets registry URL
- config get shows resolved value with source information
- Add --source option to config get for env/file/resolved
- Add version normalization (strip 'v' prefix) in install
- Skip version selection when --skill-version or --tag specified
- Enhance inspect with --details option for version history
- Reorganize help: Configuration at top, Discover & Info merged
- Move SkillVersionItem types to schema/routes.ts
- Fix error handling to return after setting exit code
- Remove versions command registration (file retained for compatibility)
- Add --details option to inspect for version history and tags
- Normalize version input (strip 'v' prefix) in install command
- Skip version selection when --skill-version or --tag is specified
- Reorganize help: merge Discover & Info sections
- Move SkillVersionItem/VersionsResponse types to schema/routes.ts
- Remove versions command registration from CLI (file retained for now)
- Fix error handling to return after setting exit code
- Update tests to reflect command changes
- Remove hardcoded default from Commander --registry option that
overrode config file settings in ALL commands
- Login command now uses loadConfigFromProgram() like other commands
instead of hardcoded http://localhost:8080
- Improved login error messages with registry URL context
process.exit() forcefully kills the process, preventing libuv from
cleanly closing HTTP connections (undici). On Windows this triggers
an assertion failure: UV_HANDLE_CLOSING.
Using process.exitCode = 1 lets Node.js exit gracefully after the
event loop drains, eliminating the assertion error while still
returning exit code 1.
ApiError previously displayed raw JSON like:
API error 403: {"code":403,"msg":"Access denied..."}
Now extracts the msg field from the API response body and displays:
Access denied to skill: find-skills
Run `skillhub login` to authenticate.
Changes:
- Add extractHumanMessage() to pull msg/message/error from response
- ApiError.message now shows human text instead of raw JSON
- 401/403 responses append login hint
- whoami: remove redundant 'Not authenticated:' prefix
Remove scripts/notify-feishu.sh and scripts/release-cli.sh from git tracking
as they are local utility files. Added to .gitignore to prevent future
accidental commits.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Revert the vite.config.ts changes from e93adaa that changed the dev
server port from 3000 to 8181 and added local dev features (env loading,
serve-skill-md plugin, proxy headers). These were local development
configs that broke CI by changing the port away from 3000 which the
Makefile health check expects.
list.ts:
- Remove locked universal section, all agents are now equal
- Users manually select which agents to list from
- No default selections, cleaner UX
check.ts:
- Add agent filtering via --agent flag or interactive selection
- Add status filtering via --status flag or interactive selection
- Default to showing only OK + Missing (not Orphaned)
- Interactive prompts for scope, agents, and statuses
- Show agent names and scope prefix in output
- Smart defaults reduce noise from orphaned skills
- list.ts: use isUniversalForScope for dynamic grouping based on scope
- list.ts: group output by skill name to avoid duplicate path listings
- uninstall.ts: use isUniversalForScope for dynamic grouping
- uninstall.ts: add printUninstallResults for consistent formatted output
- .npmignore: exclude development files from npm package
- package.json: bump version to 1.1.1
- update.ts: sort skill selection list alphabetically
- check.ts: sort results by status then name, sort agent names in locations
- install.ts: sort agent names in buildAgentSummary, sort --list output
- sync.ts: sort discovered skills by name before display
Ensures consistent alphabetical ordering across all CLI commands for
better user experience and predictability.
Group agents that share the same install path into a single line.
When more than 5 agents share a path, show first 5 names + count.
Sort agent names alphabetically within each group.
Extract buildInstallResultLines utility function to DRY up
duplicate output logic in installFromRegistry and installFromGit.
- Sort universal and non-universal agent lists by name in selectAgentsInteractive
- Exclude agents with showInUniversalList===false from locked section
- Replace spinner.stop() with spinner.succeed() before interactive prompts
to prevent 'Fetching' text from appearing as the step title
- Also fix spinner.stop -> spinner.succeed for 'Installation complete'
- Move scope selection before agent selection in both installFromRegistry
and installFromGit flows
- Use isUniversalForScope in selectAgentsInteractive so that the Universal
locked section correctly reflects the actual scope:
- Project: agents with skillsDir='.agents/skills' (Cline, Codex, Cursor, etc.)
- Global: agents with globalSkillsDir='.agents/skills' (Cline, Warp only)
- Clean up unused getUniversalAgents/getNonUniversalAgents imports
- Add isUniversalForScope(agent, isGlobal) and getAgentTargetDir(agent, isGlobal) to agent-detector.ts
- An agent is 'universal' when its target install dir equals the canonical .agents/skills directory
- This fixes incorrect symlink skipping for agents like Codex/Cursor whose globalSkillsDir
differs from .agents/skills (e.g. .codex/skills, .cursor/skills)
- Update installer.ts to use dynamic check via optional AgentInfo parameter
- Update install.ts to use getAgentTargetDir and pass agent info to installSkill
- Update uninstall.ts to use isUniversalForScope for correct path resolution
- Clean up unused isUniversalAgent import in list.ts
- Stop spinner before runInteractiveSearch to prevent terminal UI conflict
(same issue as version selection p.select)
- Make spinner messages more specific: include skill name, version, path
instead of generic "Fetching"/"Downloading"/"Extracting"
